TOP SECRET / /COMINT//REL TO USA, AUS f CAN, GBR, NZL 
















CNE Analysis in 
XKEYSCORE 



15 October 2009 



xkeyscore@nsa.ic.gov 

@nsa. ic.gov) 

JF 

^ • ^ 

DERIVED FROM: NSA/CSSM 1-52 
DATED: 20070106 

TOP SECRET //COMIIVT//RELTQ USA, AUS, CAN, GBR f NZL DECLASSIFY ON; 203201 08 







TOP SECRET/ /COMINT//REL TO USA., AUS, CAM, GBR r NZL 



These slides are classified 
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• Tao is a collector 

• analogous to field site 



• Various formats based on collection 
"equipment" 

• OLYMPUS vs UNITEDRAKE :: WC vs TU... 

• SRI plus content produces "sessions" 

• dnt payload format 

• Significant overlap with passive, especially in 
terms of collected files 

• office, pdf, ... 

• Much unique opportunity 

• Config files, registry, network information,... 

• Beginning to feed standard analytic tools 
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• PINWALE (storage/legacy) 

• TUNINGFORK (aggregate data views 
and tasking/legacy) 

• XKEYSCORE (discovery*) 

• TURBOCHASER/MARINA (profiles 
[machine and user], future tasking) 

• JOLLYROGER/TREASUREMAP (networks) 

• TURBIN E/PRESSUREWAVE/MAD 
(future) 
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• US-31 01 B, C, D, E, F, L, M 

• UNITEDRAKE 

• TUCKER 



• OLYMPUS 

• EXPANDINGPULLY (formatting issues) 

• UNIX (very little, poorly formatted) 

• Not FISA, Not ECI 

• Data retention from 29 January (many 
projects not available until 15 May) 
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CNE Related Searches 
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results 




Selecting all tables generated between '2009-9-22 00:00:00' and '2009-9-23 00:00:00' 

Pul ling hit data from xks-central.corp. nsa.ic.gov 

30 distinct users found 13998 results in 60 separate searches 



QUERY RESULTS (ad-hoc): 

userxxx email_ad dresses 22/10421 Iran NFS Domains userxxx_0808493001 25362821 8_1 
f652856 document.metadata 11/1053 f652856_0 f652856_0631 781 00125361 1 176_1 
useryyy tech 2/2 Iran Tech Search useryyy_0303242001 253646149.1 



Distribution of Searches by type: 
email_addresses: 7 
extracted.files: 32 
full Jog: 5 

documentjmetadata: 6 
phone.number: 1 
tech: 4 
registry: 5 
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XKEYSCORE Searches 

(live demo) 
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Session Viewing (XML Default) 
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(Specialized per payload) 
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• Expanded data coverage 

• UK, AUS, (NZL possibly) 

• Validator/FOX contact/survey flows?? 

• ECI data?? 

• Better TUCKER processing (both in TAG and XKS) 

• Extended plug in coverage 

• Network information (neighbor/gateway IPs etc) 

• Machine Information (host name etc) 

• Process files not found in passive 

• Registry files 

• Thumbs. db 

• Browser hi story/ bookmarks 

• Apply to Media Explotation 
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